PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113307 Google CVE debrief

A memory corruption vulnerability in Google Chrome's Extensions, prior to version 156.0.8078.47, allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. This issue, tracked as CVE-2026-113307, was publicly disclosed on October 20, 2026. The vulnerability has a Medium security severity rating according to Chromium. Defenders should assess exposure and apply patches to mitigate potential risks. The CVE record and source item provide details on the memory corruption vulnerability in Google Chrome's Extensions.

Vendor
Google
Product
Chrome
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-20
Advisory published
2026-10-20
Advisory updated
2026-10-20

Who should care

Defenders responsible for managing Google Chrome deployments, particularly in environments where user input or untrusted web content is a concern, should assess exposure and apply the patch.

Why it matters

CVE-2026-113307 is a memory corruption vulnerability in Google Chrome's Extensions that allows remote attackers to execute arbitrary code within the sandbox. Defenders should assess exposure, apply patches, and monitor for potential exploitation attempts.

  • Remote code execution within the sandbox
  • Potential for attacker exploitation of vulnerable Chrome versions
  • Need for defenders to verify and update Chrome versions
  • Importance of monitoring for crafted HTML pages

Technical summary

The memory corruption vulnerability in Google Chrome's Extensions, prior to version 156.0.8078.47, allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. This issue is tracked as CVE-2026-113307 and has a Medium security severity rating according to Chromium. The vulnerability affects Google Chrome's Extensions and can be exploited through a crafted HTML page. Defenders should assess exposure, apply patches, and monitor for potential exploitation attempts. The CVE record and source item provide details on the memory corruption vulnerability in Google Chrome's Extensions.

Defensive priority

High

Recommended defensive actions

  • Assess exposure and apply the patch for Google Chrome version 156.0.8078.47 or later
  • Review and update inventory of Chrome versions in use
  • Verify sandboxing configurations and security settings for Chrome
  • Monitor for potential exploitation attempts
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the memory corruption vulnerability in Google Chrome's Extensions. The issue allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. The Chromium security severity is rated as Medium.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113307 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113307

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113307 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113307

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2026-113307

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113307.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://issues.chromium.org/issues/514066180

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.